Inline AEAD encryption
Encrypt individual sections of any text file with AES-256-SIV, AES-256-GCM, or AES-256-GCM-SIV. Deterministic variants derive nonces from plaintext for CAS dedup.
CAPABILITIES
Protection that lives
inside the text.
Nine capabilities covering confidentiality, integrity, provenance, and collaboration — all embedded in the document itself.
Content-addressed storage
Large or sensitive blocks are stored by SHA-3-256 hash. Documents stay compact — blobs are fetched on demand from local, S3, or IPFS backends.
Digital signatures
Sign sections with Ed25519, ECDSA P-384, RSA, ML-DSA-65 (post-quantum), or OpenPGP via librnp. Signatures survive classification transitions.
Immutable integrity
Lock content with hash-based protection. Any tampering is detected on verify. Mute blocks to replace content with an opaque hash pointer.
Merge-friendly segments
EPT segments are independent and commute at the block level. Git merges, rebases, and cherry-picks work without conflicts.
Host-language agnostic
EPT directives live in comments. Works in C, Rust, Python, shell, YAML, Markdown, AsciiDoc, LaTeX, HTML, XML. Zero rendering impact.
Multi-recipient encryption
Encrypt for multiple recipients using ML-KEM (FIPS 203) encapsulation. Each recipient gets their own ciphertext; the document carries all of them.
Provenance chain anchors
Build a signed chain of anchors — each carrying parents, timestamps, and mutation types. Verify the full provenance history of any document.
Deterministic mode
Same plaintext always produces identical ciphertext. Enables CAS deduplication, idempotent transforms, and stable Git diffs on encrypted files.